A particular class of the idealized models mentioned above are those called security models. These models have played an important role in the design and evaluation of high assurance security systems. Their importance was already pointed out in the Anderson report [1]}. The
paradigmatic Bell-LaPadula model [2]}, conceived in 1973, constituted the first big effort on providing a formal setting in which to study and reason on confidentiality properties of data in time-sharing mainframe systems.
